diff --git a/README.md b/README.md
index 6041930dc..2b7c4352a 100644
--- a/README.md
+++ b/README.md
@@ -93,9 +93,10 @@ load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 # Download the rules_docker repository at release v0.6.0
 http_archive(
     name = "io_bazel_rules_docker",
-    sha256 = "c0e9d27e6ca307e4ac0122d3dd1df001b9824373fb6fb8627cd2371068e51fef",
-    strip_prefix = "rules_docker-0.6.0",
-    urls = ["https://github.com/bazelbuild/rules_docker/archive/v0.6.0.tar.gz"],
+    # Replace with a real SHA256 checksum
+    sha256 = "{SHA256}"
+    strip_prefix = "rules_docker-{HEAD}",
+    urls = ["https://github.com/bazelbuild/rules_docker/archive/{HEAD}.tar.gz"],
 )
 
 # OPTIONAL: Call this to override the default docker toolchain configuration.
@@ -116,16 +117,19 @@ docker_toolchain_configure(
   client_config="/path/to/docker/client/config",
 )
 
+# This is NOT needed when going through the language lang_image
+# "repositories" function(s).
 load(
-    "@io_bazel_rules_docker//container:container.bzl",
-    "container_pull",
+    "@io_bazel_rules_docker//repositories:repositories.bzl",
     container_repositories = "repositories",
 )
-
-# This is NOT needed when going through the language lang_image
-# "repositories" function(s).
 container_repositories()
 
+load(
+    "@io_bazel_rules_docker//container:container.bzl",
+    "container_pull",
+)
+
 container_pull(
   name = "java_base",
   registry = "gcr.io",
diff --git a/WORKSPACE b/WORKSPACE
index 8616ad194..d56fe7a49 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -13,6 +13,7 @@
 # limitations under the License.
 workspace(name = "io_bazel_rules_docker")
 
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 load(
     "//toolchains/docker:toolchain.bzl",
     docker_toolchain_configure = "toolchain_configure",
@@ -23,18 +24,21 @@ docker_toolchain_configure(
     docker_path = "/usr/bin/docker",
 )
 
+# Consumers shouldn't need to do this themselves once WORKSPACE is
+# instantiated recursively.
 load(
-    "//container:container.bzl",
-    "container_load",
-    "container_pull",
+    "//repositories:repositories.bzl",
     container_repositories = "repositories",
 )
-load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
 
-# Consumers shouldn't need to do this themselves once WORKSPACE is
-# instantiated recursively.
 container_repositories()
 
+load(
+    "//container:container.bzl",
+    "container_load",
+    "container_pull",
+)
+
 # These are for testing.
 container_pull(
     name = "distroless_base",
diff --git a/cc/image.bzl b/cc/image.bzl
index 9c71d6153..f68764a36 100644
--- a/cc/image.bzl
+++ b/cc/image.bzl
@@ -20,10 +20,13 @@ load(
     "//lang:image.bzl",
     "app_layer",
 )
+load(
+    "//repositories:repositories.bzl",
+    _repositories = "repositories",
+)
 load(
     "//container:container.bzl",
     "container_pull",
-    _repositories = "repositories",
 )
 
 # Load the resolved digests.
diff --git a/container/bundle.bzl b/container/bundle.bzl
index 9dcc1f1b1..3da139020 100644
--- a/container/bundle.bzl
+++ b/container/bundle.bzl
@@ -13,6 +13,7 @@
 # limitations under the License.
 """Rule for bundling Container images into a tarball."""
 
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(
     "//skylib:label.bzl",
     _string_to_label = "string_to_label",
@@ -87,7 +88,7 @@ def _container_bundle_impl(ctx):
     )
 
 container_bundle_ = rule(
-    attrs = dict({
+    attrs = dicts.add({
         "images": attr.string_dict(),
         # Implicit dependencies.
         "image_targets": attr.label_list(allow_files = True),
@@ -96,7 +97,7 @@ container_bundle_ = rule(
             default = False,
             mandatory = False,
         ),
-    }.items() + _layer_tools.items()),
+    }, _layer_tools),
     executable = True,
     outputs = {
         "out": "%{name}.tar",
diff --git a/container/container.bzl b/container/container.bzl
index 4a1ee9ec8..55a242413 100644
--- a/container/container.bzl
+++ b/container/container.bzl
@@ -26,10 +26,6 @@ load(
     "http_archive",
     "http_file",
 )
-load(
-    "@io_bazel_rules_docker//toolchains/docker:toolchain.bzl",
-    _docker_toolchain_configure = "toolchain_configure",
-)
 
 # Explicitly re-export the functions
 container_bundle = _container_bundle
@@ -40,203 +36,8 @@ container_layer = _container_layer
 container_import = _container_import
 container_pull = _container_pull
 container_push = _container_push
-
 container_load = _container_load
 
 container = struct(
     image = image,
 )
-
-# The release of the github.com/google/containerregistry to consume.
-CONTAINERREGISTRY_RELEASE = "v0.0.34"
-
-_local_tool_build_template = """
-sh_binary(
-    name = "{name}",
-    srcs = ["bin/{name}"],
-    visibility = ["//visibility:public"],
-)
-"""
-
-def _local_tool(repository_ctx):
-    rctx = repository_ctx
-    realpath = rctx.which(rctx.name)
-    rctx.symlink(realpath, "bin/%s" % rctx.name)
-    rctx.file(
-        "WORKSPACE",
-        'workspace(name = "{}")\n'.format(rctx.name),
-    )
-    rctx.file(
-        "BUILD",
-        _local_tool_build_template.format(name = rctx.name),
-    )
-
-local_tool = repository_rule(
-    local = True,
-    implementation = _local_tool,
-)
-
-def repositories():
-    """Download dependencies of container rules."""
-    excludes = native.existing_rules().keys()
-
-    if "puller" not in excludes:
-        http_file(
-            name = "puller",
-            executable = True,
-            sha256 = "2a3ccb6ef8f99ec0053b56380824a7c100ba00eb0e147d1bda748884113542f1",
-            urls = [("https://storage.googleapis.com/containerregistry-releases/" +
-                     CONTAINERREGISTRY_RELEASE + "/puller.par")],
-        )
-
-    if "importer" not in excludes:
-        http_file(
-            name = "importer",
-            executable = True,
-            sha256 = "0eec1a4ffb26623dbb4075e5459fa0ede36548edf872d2691ebbcb3c4ccb8cf3",
-            urls = [("https://storage.googleapis.com/containerregistry-releases/" +
-                     CONTAINERREGISTRY_RELEASE + "/importer.par")],
-        )
-
-    if "containerregistry" not in excludes:
-        http_archive(
-            name = "containerregistry",
-            sha256 = "8182728578f7d7178e7efcef8ce9074988a1a2667f20ecff5cf6234fba284dd3",
-            strip_prefix = "containerregistry-" + CONTAINERREGISTRY_RELEASE[1:],
-            urls = [("https://github.com/google/containerregistry/archive/" +
-                     CONTAINERREGISTRY_RELEASE + ".tar.gz")],
-        )
-
-    # TODO(mattmoor): Remove all of this (copied from google/containerregistry)
-    # once transitive workspace instantiation lands.
-
-    if "httplib2" not in excludes:
-        # TODO(mattmoor): Is there a clean way to override?
-        http_archive(
-            name = "httplib2",
-            build_file_content = """
-py_library(
-   name = "httplib2",
-   srcs = glob(["**/*.py"]),
-   data = ["cacerts.txt"],
-   visibility = ["//visibility:public"]
-)""",
-            sha256 = "d9f568c183d1230f271e9c60bd99f3f2b67637c3478c9068fea29f7cca3d911f",
-            strip_prefix = "httplib2-0.11.3/python2/httplib2/",
-            type = "tar.gz",
-            urls = ["https://codeload.github.com/httplib2/httplib2/tar.gz/v0.11.3"],
-        )
-
-    # Used by oauth2client
-    if "six" not in excludes:
-        # TODO(mattmoor): Is there a clean way to override?
-        http_archive(
-            name = "six",
-            build_file_content = """
-# Rename six.py to __init__.py
-genrule(
-    name = "rename",
-    srcs = ["six.py"],
-    outs = ["__init__.py"],
-    cmd = "cat $< >$@",
-)
-py_library(
-   name = "six",
-   srcs = [":__init__.py"],
-   visibility = ["//visibility:public"],
-)""",
-            sha256 = "e24052411fc4fbd1f672635537c3fc2330d9481b18c0317695b46259512c91d5",
-            strip_prefix = "six-1.9.0/",
-            type = "tar.gz",
-            urls = ["https://pypi.python.org/packages/source/s/six/six-1.9.0.tar.gz"],
-        )
-
-    # Used for authentication in containerregistry
-    if "oauth2client" not in excludes:
-        # TODO(mattmoor): Is there a clean way to override?
-        http_archive(
-            name = "oauth2client",
-            build_file_content = """
-py_library(
-   name = "oauth2client",
-   srcs = glob(["**/*.py"]),
-   visibility = ["//visibility:public"],
-   deps = [
-     "@httplib2//:httplib2",
-     "@six//:six",
-   ]
-)""",
-            sha256 = "7230f52f7f1d4566a3f9c3aeb5ffe2ed80302843ce5605853bee1f08098ede46",
-            strip_prefix = "oauth2client-4.0.0/oauth2client/",
-            type = "tar.gz",
-            urls = ["https://codeload.github.com/google/oauth2client/tar.gz/v4.0.0"],
-        )
-
-    # Used for parallel execution in containerregistry
-    if "concurrent" not in excludes:
-        # TODO(mattmoor): Is there a clean way to override?
-        http_archive(
-            name = "concurrent",
-            build_file_content = """
-py_library(
-   name = "concurrent",
-   srcs = glob(["**/*.py"]),
-   visibility = ["//visibility:public"]
-)""",
-            sha256 = "a7086ddf3c36203da7816f7e903ce43d042831f41a9705bc6b4206c574fcb765",
-            strip_prefix = "pythonfutures-3.0.5/concurrent/",
-            type = "tar.gz",
-            urls = ["https://codeload.github.com/agronholm/pythonfutures/tar.gz/3.0.5"],
-        )
-
-    # For packaging python tools.
-    if "subpar" not in excludes:
-        http_archive(
-            name = "subpar",
-            sha256 = "cf3762b10426a1887d37f127b4c1390785ecb969254096eb714cc1db371f78d6",
-            strip_prefix = "subpar-a4f9b23bf01bcc7a52d458910af65a90ee991aff",
-            urls = ["https://github.com/google/subpar/archive/a4f9b23bf01bcc7a52d458910af65a90ee991aff.tar.gz"],
-        )
-
-    if "structure_test_linux" not in excludes:
-        http_file(
-            name = "structure_test_linux",
-            executable = True,
-            sha256 = "543577685b33f0483bd4df72534ac9f84c17c9315d8afdcc536cce3591bb8f7c",
-            urls = ["https://storage.googleapis.com/container-structure-test/v1.4.0/container-structure-test-linux-amd64"],
-        )
-
-    if "structure_test_darwin" not in excludes:
-        http_file(
-            name = "structure_test_darwin",
-            executable = True,
-            sha256 = "c1bc8664d411c6df23c002b41ab1b9a3d72ae930f194a997468bfae2f54ca751",
-            urls = ["https://storage.googleapis.com/container-structure-test/v1.4.0/container-structure-test-darwin-amd64"],
-        )
-
-    # For bzl_library.
-    if "bazel_skylib" not in excludes:
-        http_archive(
-            name = "bazel_skylib",
-            sha256 = "eb5c57e4c12e68c0c20bc774bfbc60a568e800d025557bc4ea022c6479acc867",
-            strip_prefix = "bazel-skylib-0.6.0",
-            urls = ["https://github.com/bazelbuild/bazel-skylib/archive/0.6.0.tar.gz"],
-        )
-
-    if "gzip" not in excludes:
-        local_tool(
-            name = "gzip",
-        )
-
-    native.register_toolchains(
-        # Register the default docker toolchain that expects the 'docker'
-        # executable to be in the PATH
-        "@io_bazel_rules_docker//toolchains/docker:default_linux_toolchain",
-        "@io_bazel_rules_docker//toolchains/docker:default_windows_toolchain",
-        "@io_bazel_rules_docker//toolchains/docker:default_osx_toolchain",
-    )
-
-    if "docker_config" not in excludes:
-        # Automatically configure the docker toolchain rule to use the default
-        # docker binary from the system path
-        _docker_toolchain_configure(name = "docker_config")
diff --git a/container/flatten.bzl b/container/flatten.bzl
index e2502bdf8..7e10863a9 100644
--- a/container/flatten.bzl
+++ b/container/flatten.bzl
@@ -13,6 +13,7 @@
 # limitations under the License.
 """A rule to flatten container images."""
 
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(
     "//container:layer_tools.bzl",
     _get_layers = "get_from_target",
@@ -60,7 +61,7 @@ def _impl(ctx):
     return [FlattenInfo()]
 
 container_flatten = rule(
-    attrs = dict({
+    attrs = dicts.add({
         "image": attr.label(
             allow_single_file = [".tar"],
             mandatory = True,
@@ -71,7 +72,7 @@ container_flatten = rule(
             executable = True,
             allow_files = True,
         ),
-    }.items() + _layer_tools.items()),
+    }, _layer_tools),
     outputs = {
         "filesystem": "%{name}.tar",
         "metadata": "%{name}.json",
diff --git a/container/image.bzl b/container/image.bzl
index d8cb732ed..d162e6c0e 100644
--- a/container/image.bzl
+++ b/container/image.bzl
@@ -39,6 +39,7 @@ expectation in such cases is that users will write something like:
 
 """
 
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(
     "//skylib:filetype.bzl",
     container_filetype = "container",
@@ -448,7 +449,7 @@ def _impl(
         ],
     )
 
-_attrs = dict(_layer.attrs.items() + {
+_attrs = dicts.add(_layer.attrs, {
     "base": attr.label(allow_files = container_filetype),
     "legacy_repository_naming": attr.bool(default = False),
     # TODO(mattmoor): Default this to False.
@@ -495,7 +496,7 @@ _attrs = dict(_layer.attrs.items() + {
         cfg = "host",
         executable = True,
     ),
-}.items() + _hash_tools.items() + _layer_tools.items() + _zip_tools.items())
+}, _hash_tools, _layer_tools, _zip_tools)
 
 _outputs = dict(_layer.outputs)
 
diff --git a/container/import.bzl b/container/import.bzl
index c8ed68876..b5f3e5351 100644
--- a/container/import.bzl
+++ b/container/import.bzl
@@ -13,6 +13,7 @@
 # limitations under the License.
 """Rule for importing a container image."""
 
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(
     "//skylib:filetype.bzl",
     tar_filetype = "tar",
@@ -158,7 +159,7 @@ def _container_import_impl(ctx):
     )
 
 container_import = rule(
-    attrs = dict({
+    attrs = dicts.add({
         "config": attr.label(allow_files = [".json"]),
         "manifest": attr.label(
             allow_files = [".json"],
@@ -169,7 +170,7 @@ container_import = rule(
             mandatory = True,
         ),
         "repository": attr.string(default = "bazel"),
-    }.items() + _hash_tools.items() + _layer_tools.items() + _zip_tools.items()),
+    }, _hash_tools, _layer_tools, _zip_tools),
     executable = True,
     outputs = {
         "out": "%{name}.tar",
diff --git a/container/layer.bzl b/container/layer.bzl
index 97d67b04d..5e5ae3020 100644
--- a/container/layer.bzl
+++ b/container/layer.bzl
@@ -13,6 +13,7 @@
 # limitations under the License.
 """Rule for building a Container layer."""
 
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(
     "//skylib:filetype.bzl",
     container_filetype = "container",
@@ -204,7 +205,7 @@ def _impl(
         env = env or ctx.attr.env,
     )]
 
-_layer_attrs = dict({
+_layer_attrs = dicts.add({
     "data_path": attr.string(),
     "directory": attr.string(default = "/"),
     "files": attr.label_list(allow_files = True),
@@ -226,7 +227,7 @@ _layer_attrs = dict({
         executable = True,
         allow_files = True,
     ),
-}.items() + _hash_tools.items() + _layer_tools.items() + _zip_tools.items())
+}, _hash_tools, _layer_tools, _zip_tools)
 
 _layer_outputs = {
     "layer": "%{name}-layer.tar",
diff --git a/container/push.bzl b/container/push.bzl
index 3523d963a..f29a2ea02 100644
--- a/container/push.bzl
+++ b/container/push.bzl
@@ -17,6 +17,7 @@ This wraps the containerregistry.tools.fast_pusher executable in a
 Bazel rule for publishing images.
 """
 
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(
     "//skylib:path.bzl",
     "runfile",
@@ -135,7 +136,7 @@ def _impl(ctx):
     ]
 
 container_push = rule(
-    attrs = dict({
+    attrs = dicts.add({
         "image": attr.label(
             allow_single_file = [".tar"],
             mandatory = True,
@@ -169,7 +170,7 @@ container_push = rule(
             default = False,
             mandatory = False,
         ),
-    }.items() + _layer_tools.items()),
+    }, _layer_tools),
     executable = True,
     toolchains = ["@io_bazel_rules_docker//toolchains/docker:toolchain_type"],
     implementation = _impl,
diff --git a/docker/docker.bzl b/docker/docker.bzl
index 53cbe3d18..92d5becf4 100644
--- a/docker/docker.bzl
+++ b/docker/docker.bzl
@@ -24,10 +24,8 @@ load(
     _docker_layer = "container_layer",
     _docker_load = "container_load",
     _docker_pull = "container_pull",
-    _docker_repositories = "repositories",
 )
 
-docker_repositories = _docker_repositories
 docker_pull = _docker_pull
 docker_load = _docker_load
 docker_layer = _docker_layer
diff --git a/go/image.bzl b/go/image.bzl
index f91681e84..7d5ead570 100644
--- a/go/image.bzl
+++ b/go/image.bzl
@@ -20,10 +20,13 @@ load(
     "//lang:image.bzl",
     "app_layer",
 )
+load(
+    "//repositories:repositories.bzl",
+    _repositories = "repositories",
+)
 load(
     "//container:container.bzl",
     "container_pull",
-    _repositories = "repositories",
 )
 
 # It is expected that the Go rules have been properly
diff --git a/java/image.bzl b/java/image.bzl
index 540b151df..1203c94e9 100644
--- a/java/image.bzl
+++ b/java/image.bzl
@@ -19,11 +19,15 @@ The signature of war_image is compatible with java_library.
 """
 
 load("@bazel_tools//tools/build_defs/repo:jvm.bzl", "jvm_maven_import_external")
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
+load(
+    "//repositories:repositories.bzl",
+    _repositories = "repositories",
+)
 load(
     "//container:container.bzl",
     "container_pull",
     _container = "container",
-    _repositories = "repositories",
 )
 load(
     "//lang:image.bzl",
@@ -130,7 +134,7 @@ def _jar_dep_layer_impl(ctx):
     return app_layer_impl(ctx, runfiles = java_files_with_data)
 
 jar_dep_layer = rule(
-    attrs = dict(_container.image.attrs.items() + {
+    attrs = dicts.add(_container.image.attrs, {
         # The base image on which to overlay the dependency layers.
         "base": attr.label(mandatory = True),
         # The dependency whose runfiles we're appending.
@@ -144,7 +148,7 @@ jar_dep_layer = rule(
         # https://github.com/bazelbuild/bazel/issues/2176
         "data_path": attr.string(default = "."),
         "legacy_run_behavior": attr.bool(default = False),
-    }.items()),
+    }),
     executable = True,
     outputs = _container.image.outputs,
     toolchains = ["@io_bazel_rules_docker//toolchains/docker:toolchain_type"],
@@ -210,7 +214,7 @@ def _jar_app_layer_impl(ctx):
     )
 
 jar_app_layer = rule(
-    attrs = dict(_container.image.attrs.items() + {
+    attrs = dicts.add(_container.image.attrs, {
         # The binary target for which we are synthesizing an image.
         "binary": attr.label(mandatory = True),
         # The full list of dependencies that have their own layers
@@ -239,7 +243,7 @@ jar_app_layer = rule(
             default = Label("@bazel_tools//tools/jdk:current_java_runtime"),
             providers = [java_common.JavaRuntimeInfo],
         ),
-    }.items()),
+    }),
     executable = True,
     outputs = _container.image.outputs,
     toolchains = ["@io_bazel_rules_docker//toolchains/docker:toolchain_type"],
@@ -324,7 +328,7 @@ def _war_dep_layer_impl(ctx):
     )
 
 _war_dep_layer = rule(
-    attrs = dict(_container.image.attrs.items() + {
+    attrs = dicts.add(_container.image.attrs, {
         # The base image on which to overlay the dependency layers.
         "base": attr.label(mandatory = True),
         # The dependency whose runfiles we're appending.
@@ -338,7 +342,7 @@ _war_dep_layer = rule(
         # WE WANT PATHS FLATTENED
         # "data_path": attr.string(default = "."),
         "legacy_run_behavior": attr.bool(default = False),
-    }.items()),
+    }),
     executable = True,
     outputs = _container.image.outputs,
     toolchains = ["@io_bazel_rules_docker//toolchains/docker:toolchain_type"],
@@ -361,7 +365,7 @@ def _war_app_layer_impl(ctx):
     return _container.image.implementation(ctx, files = files)
 
 _war_app_layer = rule(
-    attrs = dict(_container.image.attrs.items() + {
+    attrs = dicts.add(_container.image.attrs, {
         # The library target for which we are synthesizing an image.
         "library": attr.label(mandatory = True),
         # The full list of dependencies that have their own layers
@@ -376,7 +380,7 @@ _war_app_layer = rule(
         # WE WANT PATHS FLATTENED
         # "data_path": attr.string(default = "."),
         "legacy_run_behavior": attr.bool(default = False),
-    }.items()),
+    }),
     executable = True,
     outputs = _container.image.outputs,
     toolchains = ["@io_bazel_rules_docker//toolchains/docker:toolchain_type"],
diff --git a/lang/image.bzl b/lang/image.bzl
index 7a4aeeef1..d4851bb70 100644
--- a/lang/image.bzl
+++ b/lang/image.bzl
@@ -14,6 +14,7 @@
 """Helpers for synthesizing foo_image targets matching foo_binary.
 """
 
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(
     "//container:container.bzl",
     _container = "container",
@@ -217,7 +218,7 @@ def app_layer_impl(ctx, runfiles = None, emptyfiles = None):
     )
 
 _app_layer = rule(
-    attrs = dict(_container.image.attrs.items() + {
+    attrs = dicts.add(_container.image.attrs, {
         # The binary target for which we are synthesizing an image.
         # If specified, the layer will not be "image agnostic", meaning
         # that the runfiles required by "dep" will be created (or symlinked,
@@ -242,7 +243,7 @@ _app_layer = rule(
         "directory": attr.string(default = "/app"),
         "legacy_run_behavior": attr.bool(default = False),
         "data": attr.label_list(allow_files = True),
-    }.items()),
+    }),
     executable = True,
     outputs = _container.image.outputs,
     toolchains = ["@io_bazel_rules_docker//toolchains/docker:toolchain_type"],
diff --git a/nodejs/image.bzl b/nodejs/image.bzl
index 41427f438..ff8c56352 100644
--- a/nodejs/image.bzl
+++ b/nodejs/image.bzl
@@ -16,16 +16,20 @@
 The signature of this rule is compatible with nodejs_binary.
 """
 
+load("@bazel_skylib//lib:dicts.bzl", "dicts")
 load(
     "//lang:image.bzl",
     "app_layer",
     "app_layer_impl",
 )
+load(
+    "//repositories:repositories.bzl",
+    _repositories = "repositories",
+)
 load(
     "//container:container.bzl",
     "container_pull",
     _container = "container",
-    _repositories = "repositories",
 )
 load("@build_bazel_rules_nodejs//:defs.bzl", "nodejs_binary")
 
@@ -70,7 +74,7 @@ def _dep_layer_impl(ctx):
     return app_layer_impl(ctx, runfiles = _runfiles, emptyfiles = _emptyfiles)
 
 _dep_layer = rule(
-    attrs = dict(_container.image.attrs.items() + {
+    attrs = dicts.add(_container.image.attrs, {
         # The base image on which to overlay the dependency layers.
         "base": attr.label(mandatory = True),
         # The dependency whose runfiles we're appending.
@@ -87,7 +91,7 @@ _dep_layer = rule(
         "data_path": attr.string(default = "."),
         "directory": attr.string(default = "/app"),
         "legacy_run_behavior": attr.bool(default = False),
-    }.items()),
+    }),
     executable = True,
     outputs = _container.image.outputs,
     toolchains = ["@io_bazel_rules_docker//toolchains/docker:toolchain_type"],
diff --git a/python/image.bzl b/python/image.bzl
index 4f8852812..a8f857943 100644
--- a/python/image.bzl
+++ b/python/image.bzl
@@ -21,10 +21,13 @@ load(
     "app_layer",
     "filter_layer",
 )
+load(
+    "//repositories:repositories.bzl",
+    _repositories = "repositories",
+)
 load(
     "//container:container.bzl",
     "container_pull",
-    _repositories = "repositories",
 )
 
 # Load the resolved digests.
diff --git a/python3/image.bzl b/python3/image.bzl
index 77a50a891..29bd38140 100644
--- a/python3/image.bzl
+++ b/python3/image.bzl
@@ -20,10 +20,13 @@ load(
     "//lang:image.bzl",
     "app_layer",
 )
+load(
+    "//repositories:repositories.bzl",
+    _repositories = "repositories",
+)
 load(
     "//container:container.bzl",
     "container_pull",
-    _repositories = "repositories",
 )
 
 # Load the resolved digests.
diff --git a/repositories/BUILD b/repositories/BUILD
new file mode 100644
index 000000000..426ddc016
--- /dev/null
+++ b/repositories/BUILD
@@ -0,0 +1,16 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+package(default_visibility = ["//visibility:public"])
+
+licenses(["notice"])  # Apache 2.0
diff --git a/repositories/repositories.bzl b/repositories/repositories.bzl
new file mode 100644
index 000000000..5490f9137
--- /dev/null
+++ b/repositories/repositories.bzl
@@ -0,0 +1,218 @@
+# Copyright 2017 The Bazel Authors. All rights reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Rules for load all dependencies of rules_docker."""
+
+load(
+    "@bazel_tools//tools/build_defs/repo:http.bzl",
+    "http_archive",
+    "http_file",
+)
+load(
+    "@io_bazel_rules_docker//toolchains/docker:toolchain.bzl",
+    _docker_toolchain_configure = "toolchain_configure",
+)
+
+# The release of the github.com/google/containerregistry to consume.
+CONTAINERREGISTRY_RELEASE = "v0.0.34"
+
+_local_tool_build_template = """
+sh_binary(
+    name = "{name}",
+    srcs = ["bin/{name}"],
+    visibility = ["//visibility:public"],
+)
+"""
+
+def _local_tool(repository_ctx):
+    rctx = repository_ctx
+    realpath = rctx.which(rctx.name)
+    rctx.symlink(realpath, "bin/%s" % rctx.name)
+    rctx.file(
+        "WORKSPACE",
+        'workspace(name = "{}")\n'.format(rctx.name),
+    )
+    rctx.file(
+        "BUILD",
+        _local_tool_build_template.format(name = rctx.name),
+    )
+
+local_tool = repository_rule(
+    local = True,
+    implementation = _local_tool,
+)
+
+def repositories():
+    """Download dependencies of container rules."""
+    excludes = native.existing_rules().keys()
+
+    if "puller" not in excludes:
+        http_file(
+            name = "puller",
+            executable = True,
+            sha256 = "2a3ccb6ef8f99ec0053b56380824a7c100ba00eb0e147d1bda748884113542f1",
+            urls = [("https://storage.googleapis.com/containerregistry-releases/" +
+                     CONTAINERREGISTRY_RELEASE + "/puller.par")],
+        )
+
+    if "importer" not in excludes:
+        http_file(
+            name = "importer",
+            executable = True,
+            sha256 = "0eec1a4ffb26623dbb4075e5459fa0ede36548edf872d2691ebbcb3c4ccb8cf3",
+            urls = [("https://storage.googleapis.com/containerregistry-releases/" +
+                     CONTAINERREGISTRY_RELEASE + "/importer.par")],
+        )
+
+    if "containerregistry" not in excludes:
+        http_archive(
+            name = "containerregistry",
+            sha256 = "8182728578f7d7178e7efcef8ce9074988a1a2667f20ecff5cf6234fba284dd3",
+            strip_prefix = "containerregistry-" + CONTAINERREGISTRY_RELEASE[1:],
+            urls = [("https://github.com/google/containerregistry/archive/" +
+                     CONTAINERREGISTRY_RELEASE + ".tar.gz")],
+        )
+
+    # TODO(mattmoor): Remove all of this (copied from google/containerregistry)
+    # once transitive workspace instantiation lands.
+
+    if "httplib2" not in excludes:
+        # TODO(mattmoor): Is there a clean way to override?
+        http_archive(
+            name = "httplib2",
+            build_file_content = """
+py_library(
+   name = "httplib2",
+   srcs = glob(["**/*.py"]),
+   data = ["cacerts.txt"],
+   visibility = ["//visibility:public"]
+)""",
+            sha256 = "d9f568c183d1230f271e9c60bd99f3f2b67637c3478c9068fea29f7cca3d911f",
+            strip_prefix = "httplib2-0.11.3/python2/httplib2/",
+            type = "tar.gz",
+            urls = ["https://codeload.github.com/httplib2/httplib2/tar.gz/v0.11.3"],
+        )
+
+    # Used by oauth2client
+    if "six" not in excludes:
+        # TODO(mattmoor): Is there a clean way to override?
+        http_archive(
+            name = "six",
+            build_file_content = """
+# Rename six.py to __init__.py
+genrule(
+    name = "rename",
+    srcs = ["six.py"],
+    outs = ["__init__.py"],
+    cmd = "cat $< >$@",
+)
+py_library(
+   name = "six",
+   srcs = [":__init__.py"],
+   visibility = ["//visibility:public"],
+)""",
+            sha256 = "e24052411fc4fbd1f672635537c3fc2330d9481b18c0317695b46259512c91d5",
+            strip_prefix = "six-1.9.0/",
+            type = "tar.gz",
+            urls = ["https://pypi.python.org/packages/source/s/six/six-1.9.0.tar.gz"],
+        )
+
+    # Used for authentication in containerregistry
+    if "oauth2client" not in excludes:
+        # TODO(mattmoor): Is there a clean way to override?
+        http_archive(
+            name = "oauth2client",
+            build_file_content = """
+py_library(
+   name = "oauth2client",
+   srcs = glob(["**/*.py"]),
+   visibility = ["//visibility:public"],
+   deps = [
+     "@httplib2//:httplib2",
+     "@six//:six",
+   ]
+)""",
+            sha256 = "7230f52f7f1d4566a3f9c3aeb5ffe2ed80302843ce5605853bee1f08098ede46",
+            strip_prefix = "oauth2client-4.0.0/oauth2client/",
+            type = "tar.gz",
+            urls = ["https://codeload.github.com/google/oauth2client/tar.gz/v4.0.0"],
+        )
+
+    # Used for parallel execution in containerregistry
+    if "concurrent" not in excludes:
+        # TODO(mattmoor): Is there a clean way to override?
+        http_archive(
+            name = "concurrent",
+            build_file_content = """
+py_library(
+   name = "concurrent",
+   srcs = glob(["**/*.py"]),
+   visibility = ["//visibility:public"]
+)""",
+            sha256 = "a7086ddf3c36203da7816f7e903ce43d042831f41a9705bc6b4206c574fcb765",
+            strip_prefix = "pythonfutures-3.0.5/concurrent/",
+            type = "tar.gz",
+            urls = ["https://codeload.github.com/agronholm/pythonfutures/tar.gz/3.0.5"],
+        )
+
+    # For packaging python tools.
+    if "subpar" not in excludes:
+        http_archive(
+            name = "subpar",
+            sha256 = "cf3762b10426a1887d37f127b4c1390785ecb969254096eb714cc1db371f78d6",
+            strip_prefix = "subpar-a4f9b23bf01bcc7a52d458910af65a90ee991aff",
+            urls = ["https://github.com/google/subpar/archive/a4f9b23bf01bcc7a52d458910af65a90ee991aff.tar.gz"],
+        )
+
+    if "structure_test_linux" not in excludes:
+        http_file(
+            name = "structure_test_linux",
+            executable = True,
+            sha256 = "543577685b33f0483bd4df72534ac9f84c17c9315d8afdcc536cce3591bb8f7c",
+            urls = ["https://storage.googleapis.com/container-structure-test/v1.4.0/container-structure-test-linux-amd64"],
+        )
+
+    if "structure_test_darwin" not in excludes:
+        http_file(
+            name = "structure_test_darwin",
+            executable = True,
+            sha256 = "c1bc8664d411c6df23c002b41ab1b9a3d72ae930f194a997468bfae2f54ca751",
+            urls = ["https://storage.googleapis.com/container-structure-test/v1.4.0/container-structure-test-darwin-amd64"],
+        )
+
+    # For bzl_library.
+    if "bazel_skylib" not in excludes:
+        http_archive(
+            name = "bazel_skylib",
+            sha256 = "eb5c57e4c12e68c0c20bc774bfbc60a568e800d025557bc4ea022c6479acc867",
+            strip_prefix = "bazel-skylib-0.6.0",
+            urls = ["https://github.com/bazelbuild/bazel-skylib/archive/0.6.0.tar.gz"],
+        )
+
+    if "gzip" not in excludes:
+        local_tool(
+            name = "gzip",
+        )
+
+    native.register_toolchains(
+        # Register the default docker toolchain that expects the 'docker'
+        # executable to be in the PATH
+        "@io_bazel_rules_docker//toolchains/docker:default_linux_toolchain",
+        "@io_bazel_rules_docker//toolchains/docker:default_windows_toolchain",
+        "@io_bazel_rules_docker//toolchains/docker:default_osx_toolchain",
+    )
+
+    if "docker_config" not in excludes:
+        # Automatically configure the docker toolchain rule to use the default
+        # docker binary from the system path
+        _docker_toolchain_configure(name = "docker_config")
diff --git a/testing/custom_toolchain_auth/WORKSPACE b/testing/custom_toolchain_auth/WORKSPACE
index 041003650..6502fd502 100644
--- a/testing/custom_toolchain_auth/WORKSPACE
+++ b/testing/custom_toolchain_auth/WORKSPACE
@@ -34,16 +34,20 @@ docker_toolchain_configure(
     client_config = client_config,
 )
 
+# This is NOT needed when going through the language lang_image
+# "repositories" function(s).
 load(
-    "@io_bazel_rules_docker//container:container.bzl",
-    "container_pull",
+    "@io_bazel_rules_docker//repositories:repositories.bzl",
     container_repositories = "repositories",
 )
 
-# This is NOT needed when going through the language lang_image
-# "repositories" function(s).
 container_repositories()
 
+load(
+    "@io_bazel_rules_docker//container:container.bzl",
+    "container_pull",
+)
+
 # For testing
 container_pull(
     name = "distroless_fixed_id",
diff --git a/testing/default_toolchain/WORKSPACE b/testing/default_toolchain/WORKSPACE
index e64a5b7c5..a65c99c4d 100644
--- a/testing/default_toolchain/WORKSPACE
+++ b/testing/default_toolchain/WORKSPACE
@@ -29,13 +29,17 @@ load(
 docker_toolchain_configure(name = "docker_config")
 
 load(
-    "@io_bazel_rules_docker//container:container.bzl",
-    "container_pull",
+    "@io_bazel_rules_docker//repositories:repositories.bzl",
     container_repositories = "repositories",
 )
 
 container_repositories()
 
+load(
+    "@io_bazel_rules_docker//container:container.bzl",
+    "container_pull",
+)
+
 # For testing
 container_pull(
     name = "distroless_fixed_id",
diff --git a/testing/e2e.sh b/testing/e2e.sh
index 200aee119..e369957b2 100755
--- a/testing/e2e.sh
+++ b/testing/e2e.sh
@@ -107,11 +107,16 @@ local_repository(
     path = "$ROOT",
 )
 
+load(
+  "@io_bazel_rules_docker//repositories:repositories.bzl",
+  container_repositories = "repositories",
+)
+container_repositories()
+
 load(
   "@io_bazel_rules_docker//docker:docker.bzl",
-  "docker_repositories", "docker_pull"
+  "docker_pull",
 )
-docker_repositories()
 
 docker_pull(
   name = "pause",